Is cold email legal? B2B rules in the US, EU, UK and Canada

Cold email is legal in most countries when it follows the local rules, and the rules differ more than most guides admit. The US allows business-to-business cold email if the sender is honest, includes a postal address and offers a working opt-out. The UK and France allow email to business addresses with a clear way to object. Germany and Canada generally require consent, with narrow exceptions. Everywhere, where you got the address matters as much as what you write.

Most articles on this question either declare cold email illegal under GDPR or wave the question away. Both are wrong. This guide sets out what the law and the regulators actually say in five jurisdictions, with links to the primary sources, so you can see the text for yourself.

This is general information, not legal advice. Laws change, regulators update their guidance, and the right answer for your business depends on facts this article cannot know. If you send to a country regularly, a short consultation with a local lawyer is inexpensive insurance.

The short answer, by jurisdiction

The table compresses a lot. The sections below explain each row, including the conditions that decide whether a particular message is lawful.

United States: CAN-SPAM

The U.S. federal law is the CAN-SPAM Act, enforced by the Federal Trade Commission. Despite its name, it does not only cover bulk mail. In the FTC's words, the law covers all commercial messages and "makes no exception for business-to-business email." A single sales email to a single person is covered.

CAN-SPAM is an opt-out law. You do not need permission before the first message, but every commercial message must meet these requirements, summarized from the FTC's compliance guide:

1. No false or misleading header information. The From, To, Reply-To and routing information must be accurate and identify who sent the message.
2. No deceptive subject lines. The subject must reflect what the message contains.
3. Identify the message as an advertisement. The FTC says the law gives "a lot of leeway" in how, but the disclosure must be clear and conspicuous.
4. Include a valid physical postal address: a street address, a registered post office box, or a registered private mailbox.
5. Explain clearly how to opt out of future messages, with a return email address or another easy internet-based way to do it.
6. Honor opt-outs within 10 business days. The opt-out mechanism must keep working for at least 30 days after you send, and you cannot charge a fee or demand more than an email address.
7. Do not sell or transfer the address of someone who opted out.
8. Monitor anyone who sends on your behalf. You cannot contract away the responsibility, and both the advertiser and the sender can be held liable.

Penalties, and the practices that make them worse

Each separate email that violates the law can draw a penalty of up to $53,088, according to the FTC's guide. The law also sets out aggravated violations with criminal penalties, and two of them are directly relevant to prospecting: harvesting email addresses, and generating addresses through a dictionary attack, which the FTC describes as sending to addresses made of random letters and numbers in the hope of reaching valid ones. Guessing addresses at scale is not only a deliverability problem. It can be a legal one.

The FTC guide also notes that email making misleading claims about products or services may fall under laws against deceptive advertising, such as Section 5 of the FTC Act. An invented result in a sales email is not just a bad look. We cover how AI-written outreach produces those claims, and how to prevent it, in our article on AI sales emails that make things up.

European Union: GDPR, plus national email rules

Two layers of law apply to cold email in the EU. The General Data Protection Regulation governs any processing of personal data, and a named person's work address, such as anna.schmidt@company.example, is personal data. Separately, each member state has its own rules on electronic marketing, implementing the EU's ePrivacy Directive, and those rules differ from country to country. A message must satisfy both layers.

A lawful basis: legitimate interest

GDPR requires a lawful basis for processing personal data. For B2B outreach, the usual basis is legitimate interest under Article 6(1)(f), and the regulation's own recitals support it: Recital 47 says that processing "for direct marketing purposes may be regarded as carried out for a legitimate interest."

May be, not is. Legitimate interest requires a balancing test: your interest in contacting the person must not be overridden by their interests and rights, taking into account what they could reasonably expect. A message to a head of operations about operations software is easy to defend. A message to the same person about a product unrelated to their work is much harder. Relevance to the person's role is the single most useful thing you can control.

Telling people where you got their details

When you obtain someone's data from a source other than them, such as their company's website or a data provider, Article 14 applies. If you use the data to communicate with the person, you must give them the required information at the latest at the time of the first communication. That information includes who you are, why you are processing their data, the legal basis, how long you keep it, their rights, and, under Article 14(2)(f), the source the data came from, including whether it came from publicly accessible sources.

In practice, that means a short line in the first message linking to a page that explains these points. A cold email to an EU recipient without that information is missing something the regulation requires, however good the message is.

The right to object, stated in the first message

Article 21 gives people the right to object to direct marketing at any time, and once they do, their data may no longer be processed for that purpose. Unlike most GDPR rights, this one has no balancing test: the objection simply wins. Article 21(4) adds that, at the latest at the time of the first communication, the right must be "explicitly brought to the attention of the data subject" and "presented clearly and separately from any other information." A buried sentence in a long footer does not meet that standard.

Under GDPR, an objection to marketing is not weighed. It is obeyed.

France: allowed when it relates to the person's work

France's data protection authority, the CNIL, publishes specific guidance on email prospecting. For professionals, it allows prospecting without prior consent when the subject of the message relates to the recipient's profession, provided the person is informed that their address will be used for prospecting and can object simply and free of charge. The CNIL also notes that generic company addresses such as contact@ or info@ are company contact details rather than a person's, and the rules protecting individuals do not apply to them in the same way.

Germany: assume consent is required

Germany is stricter. Section 7(2) no. 2 of the Act against Unfair Competition (UWG) treats advertising by electronic mail without the addressee's prior express consent as an unacceptable nuisance in every case. Unlike the neighboring rule on telephone calls, it does not distinguish consumers from businesses, so it applies to B2B email too. A narrow exception in Section 7(3) covers existing customers whose address you obtained in connection with a sale, for similar products, provided they were told they can object.

For cold outreach to German recipients, the safe assumption is that you need consent. That is why Snaut flags German recipients for review rather than treating them like the rest of the EU.

United Kingdom: PECR and UK GDPR

After Brexit, the UK has its own versions of both layers: the Privacy and Electronic Communications Regulations (PECR) for marketing messages, and UK GDPR for personal data. The Information Commissioner's Office explains how they combine in its guide to electronic mail marketing.

• Corporate subscribers, such as limited companies, limited liability partnerships, Scottish partnerships and government bodies, can receive marketing email without prior consent.
• You must still identify yourself and provide a valid contact address in every message.
• Sole traders and some partnerships are treated as individuals, so the stricter rules apply: generally consent, or the narrow soft opt-in for existing customers.
• When the address belongs to a named employee, UK GDPR applies to that personal data, including the right to object.
• The ICO recommends keeping a do-not-email list so that people who object are not contacted again.

One caution: the ICO notes that its guidance is under review following the Data (Use and Access) Act. Check the current version before relying on the details.

Canada: CASL

Canada's Anti-Spam Legislation is a consent law. A commercial electronic message needs the recipient's consent, which can be express or implied, and every message must identify the sender and include an unsubscribe mechanism. According to the statute, the unsubscribe mechanism must remain valid for at least 60 days after the message is sent, and requests must be processed within 10 business days. Maximum administrative penalties are $1 million for an individual and $10 million for any other person, such as a company.

For prospecting, the most relevant form of implied consent is conspicuous publication. Consent is implied when a person has conspicuously published their address, or allowed it to be published, without a statement that they do not want commercial messages, and the message is relevant to their business role or functions. The regulator is explicit that this has limits. In its CASL FAQ, the CRTC says the exemption is not a broad licence to send messages to any published address: the message has to relate to why the address was published.

Other forms of implied consent, such as existing business relationships, exist but rarely apply to a first cold message. Because CASL's consent model is closer to Germany's than to the US model, Snaut flags Canadian recipients for review as well.

California: business contacts are personal information

Until the end of 2022, the California Consumer Privacy Act largely exempted business-to-business contact data. That exemption has expired. The California Privacy Protection Agency's FAQ confirms that the exemptions for business and employee information ended on January 1, 2023. For businesses that meet the law's thresholds, a California professional's work details now carry the same rights as consumer data, including the rights to know, to delete and to opt out of sale or sharing.

The CCPA does not prohibit cold email. It changes how you must handle the data behind it: what you disclose, how you respond to requests, and how you treat a request to delete.

Where the data came from matters as much as the message

Most compliance guides focus on the email. Regulators increasingly focus on the list. A perfectly written message to an address obtained unlawfully is still a problem, and several of the rules above are about collection rather than content.

• CAN-SPAM treats address harvesting and dictionary attacks as aggravated violations.
• GDPR Article 14 requires you to tell the person where their data came from, which assumes you know and recorded it.
• CASL's conspicuous publication exemption depends on how and why the address was published.
• Platform terms add their own limits. Reddit's Data API Terms, for example, prohibit using its APIs to spam users.

This is why every contact in Snaut is tied to a recorded data source whose allowed uses must include outreach, and why a lead imported from a file, a paste, a webhook or a CRM records where it came from and the user's statement of their right to use it. It is also why Snaut does not scrape LinkedIn, Google Maps or Search results, Yelp, Facebook or Instagram, whose terms do not allow it. Our overview of how an AI agent finds customers explains which sources it does use.

What every compliant first message has in common

The jurisdictions differ, but the messages that satisfy them share a recognizable shape. A first message that does all of the following is in a strong position almost everywhere it is permitted at all:

1. It comes from a real person at a real company, with accurate headers and a subject that reflects the content.
2. It is relevant to the recipient's role. This is the heart of legitimate interest in the EU and of CASL's publication exemption in Canada.
3. It makes clear that it is a commercial message.
4. It includes your postal address and a simple way to opt out, presented clearly and separately.
5. For EU and UK recipients, it links to a notice explaining who you are, why you are writing, the legal basis and where the data came from.
6. It contains nothing false. Every factual claim about the recipient or about your results can be traced to a source.
7. An objection is honored immediately and permanently, including against future imports of the same person.
8. The address was obtained from a source you are allowed to use for outreach, and you recorded which one.

Structure matters too. A short message about the recipient's own situation, with one question, is easier to defend as relevant than a generic pitch. We explain that structure in how to write a first message that gets replies.

The same email, adapted for three jurisdictions

To see what actually changes, take one first message and adjust only the parts the law governs. The sender, product and recipient below are fictional; each requirement comes from the sections above.

In practice the U.S. version is the shortest: a real sender, a subject that matches the content, a sentence identifying the message as an advertisement, a postal address, and a working opt-out. Nothing about the recipient's data has to be disclosed, because CAN-SPAM does not require it.

The EU version adds two paragraphs that the U.S. version does not need. The first explains, in a sentence or two, why the person is receiving the message and where their details came from, and links to a notice with the full information. The second states the right to object, on its own, not folded into the unsubscribe sentence. Both go in the first message, not in a follow-up.

The Canadian version looks closer to the U.S. one, but the test before you send is different. You need a consent route, and for a cold first message that usually means the conspicuously-published-address exception, which only holds if the message relates to the recipient's role. The unsubscribe mechanism must keep working for 60 days, which is longer than the U.S. minimum.

What does not change is the part that matters most. The message has to be about something real in the recipient's work, has to come from someone who can be identified, and has to make leaving easy. A message that fails those three tests is a problem in every jurisdiction, whatever the footer says.

How Snaut handles this, and what it leaves to you

Snaut enforces several of these rules mechanically, at the send gate, so that a message missing one of them cannot be sent:

• Every message carries a footer with the sender's name and title, the company, the physical postal address, and a separate opt-out sentence: "If you'd rather not hear from me again, just let me know and I won't email you again."
• Every message carries List-Unsubscribe and List-Unsubscribe-Post headers, so mail clients can offer their own one-click unsubscribe.
• For recipients in the EU and the UK, the footer must include the line "Why you're getting this and where we got your details" with a working link to your privacy notice. A workspace without a privacy link cannot send to those recipients at all.
• Recipients in Germany and Canada are flagged for review rather than treated as allowed by default.
• Opt-outs and suppressions are stored as one-way hashes and kept forever, so a person who objects is never contacted again, even through a later import.
• A request to erase a person removes them everywhere and blocks them from being collected again.
• Contacts who never engaged are purged after 180 days, and personal facts that are not used or refreshed are purged after 365 days.
• Agent-signed messages say they come from an AI assistant. The agent never claims to be a human.

Some decisions remain yours, and no software can make them for you. Snaut does not decide whether your offer is relevant enough to a given person to satisfy a balancing test, whether your privacy notice is complete, or how your business should label commercial messages for U.S. recipients. Those are judgments about your business, and they belong with you and, where it matters, your lawyer. Our guide to cold email deliverability covers the technical requirements that sit alongside these legal ones.

Before you send to a new country

1. Find out which rules apply: the recipient's location usually decides, not yours.
2. Decide your lawful basis or consent route, and write down why the message is relevant to the recipients' roles.
3. Record the source of every address and confirm you may use it for outreach.
4. Prepare a privacy notice that names the source of the data, and link it in the first message for EU and UK recipients.
5. Make sure every message has your postal address, a clear commercial identity and a separate, simple way to opt out.
6. Load your existing suppression list before the first send, and honor every objection permanently.
7. Treat Germany and Canada as consent-first unless a lawyer tells you an exception applies.
8. Check the regulator's current guidance; several of the sources in this article were updated within the past year.

This article is general information, not legal advice, and reflects the cited sources as checked in October 2026. Laws and guidance change; follow the links below for the current text, and consult a qualified lawyer for decisions about your business.